Andrew Brown 
_ 


From: Andrew Brown 

Sent: Saturday, September 17, 2016 3:00 PM 
To: Sussmann, Michael A. (Perkins Coie) 
Ce: Hawkins, E. A. (WF) (FBI) 

Subject: Re: Checking in 


He works closely with Charlie baker. Leslie.dach@outlook.com is his email. 
He was involved at a high level with convention at least. 
Sent from my iPhone 


On Sep 17, 2016, at 1:02 PM, Sussmann, Michael A. (Perkins Coie) <MSussmann@perkinscoie.com> wrote: 


Yes - | just heard. He's at HFA now. 


On Sep 17, 2016, at 12:55 PM, Hawkins, E. A. (WF) (FBI) <Adrian. Hawkins @ic.fbi.gov> wrote: 


Please disregard. We've made contact. 


sahoae Original message -------- 

From: "Sussmann, Michael A. (Perkins Coie)" <MSussmann@perkinscoie.com> 
Date: 09/16/2016 9:56 PM (GMT-05:00) 

To: "Hawkins, E. A. (WF) (FBI)" <Adrian.Hawkins@ic.fbi.gov> 

Cc: Andrew Brown <BrownA@dnc.org> 

Subject: Re: Checking in 


Thank you. 


Andrew — Do you know Mr. Dach? 


Michael Sussmann | Perkins Coie LLP 
P: 202.654.6333 


www. perkinscoie.com/msussmann 


SCC_0002459 


No. 1:21-cr-00582-CRC (D.D.C.) DX-142_0001 


From: "Hawkins, E. A. (WEF) (FBI)" <Adrian. Hawkins @ic.fbi.gov> 
Date: Friday, September 16, 2016 at 8:59 PM 


To: Michael <msussmann@perkinscoie.com> 
Cc: Andrew Brown <BrownA@dnc.org> 
Subject: Re: Checking in 


?Good evening gentlemen, 


Have information that a Microsoft email account (Office 365?) used by Mr. Leslie Dach? may 
be compromised, and trying to get contact information for that individual to confirm. 


It's my understanding (this may change, couple of moving parts) Mr. Dach's local FBI office will 
ask him to confirm his accounts, and provide additional information on how to restore access. ? 


E. Adrian Hawkins 


Special Agent 
Washington Field Office 


S 6674 


From: Hawkins, E. A. (WF) (FBI) 

Sent: Wednesday, September 14, 2016 9:20 PM 

To: Sussmann, Michael A. (Perkins Coie}; Ryan McCombs 
Cc: Justin Weissert; Andrew Brown 

Subject: Re: Checking in 


| have the file. It's 125MB so | can't attach on this system. I'll try and get to you first thing 
tomorrow somehow. In the mean time | attached a file listing. 


Looks like it was uploaded to VirusTotal: 


SCC_0002460 


No. 1:21-cr-00582-CRC (D.D.C.) DX-142_0002 


2016-09-14 00:37:38 
File name when uploaded: 


stuffformike.zip? 


E. Adrian Hawkins 
Special Agent 
Washington Field Office 


SEND 6674 


From: Sussmann, Michael A. (Perkins Coie) <MSussmann@perkinscoie.com> 
Sent: Wednesday, September 14, 2016 9:00 PM 

To: Hawkins, E. A. (WF) (FBI); Ryan McCombs 

Ce: Justin Weissert; Andrew Brown 

Subject: Re: Checking in 


Adrian, 


I just spoke with Elliot Peterson from Anchorage — he said Pittsburgh has everything that was 
posted. Is there a way for you to get that to us? 


Thanks, 
Michael 
Michael Sussmann | Perkins Coie LLP 


P: 202.654.6333 
www. perkinscoie.com/msussmann 


From: "Hawkins, E. A. (WF) (FBI}" <Adrian. Hawkins @ic.fbi.gov> 
Date: Wednesday, September 14, 2016 at 9:06 PM 


To: Ryan McCombs <ryan.mccombs@crowdstrike.com>, Michael <msussmann@perkinscoie.com> 


Cc: Justin Weissert <justin.weissert@crowdstrike.com> 
Subject: Re: Checking in 


We just got notified by some industry personnel that some previously unreleased DNC documents 
were uploaded to Virus Total today. In the files there was a contact list that I attached here with 
lots of personal emails for people. 


Rumor is that these files are supposed to be the network share for a guy named Mike Conlow who 
worked IT until April 2011. The VT hash: 


4db9c02dba6eb3dbb5c103b82889ecb29b3086b50657d978dc03acacaa57ca3a 


SCC_0002461 


No. 1:21-cr-00582-CRC (D.D.C.) DX-142_0003 


(NFI), may have more info tomorrow. 


E. Adrian Hawkins 
Special Agent 
Washington Field Office 


SENSED 6674 


From: Ryan McCombs <ryan.mccombs @crowdstrike.com> 
Sent: Wednesday, September 14, 2016 10:02 AM 


To: Hawkins, E. A. (WF) (FBI); MSussmann@perkinscoie.com 


Cc: Justin Weissert 
Subject: [Suspect] RE: Checking in 


This message has failed Internet mail authentication checks and is considered suspicious. The 
sender information may be spoofed or this possibly could be a false positive identification. 
Prior to acting on the contents of the message, recipients may want to determine whether the 
sender is valid through other means 


NOTICE: This communication may contain privileged or other confidential information. If you have received it in error please advise the 
sender by reply email and immediately delete the message and any attachments without copying or disclosing the contents. Thank 
you. 


NOTICE: This communication may contain privileged or other confidential information. If you have received it in error, please advise the 
sender by reply email and immediately delete the message and any attachments without copying or disclosing the contents. Thank 
you. 


NOTICE: This communication may contain privileged or other confidential information. If you have received it in error, please advise the 
sender by reply email and immediately delete the message and any attachments without copying or disclosing the contents. Thank 
you. 


SCC_0002462 


No. 1:21-cr-00582-CRC (D.D.C.) DX-142_0004 


